user ldap results in my search

[chadman]

I have an ldap search that pulls computers from active directory group and works great. something like:

|ldapsearch domain=domaingoeshere search=(&(objectClass=computer)(memberof="cn=mygroup,domaindoeshere)) attrs="name"

I have another search that will work great with one computer name that looks like:

sourcetype=patchlog host=servername | eventstats latest(_time) as TIME | where _time = TIME |dedup TIME |table name DateTime Status

How can I make this work with one search for every computer listed in my first ldap search? So instead of having the host=servname it will use the list of computers from my first search. The ldap search will output server names like server1 server2 server3 etc.

[gcusello · Accepted solution]

Hi,
You could use the first search as subsearch of the Second but it Will be very slow.
The best solution is to schedule first search to populate a lookup (first search and the outputlookup Command).
Then use lookup in the second search, something like this
sourcetype=patchlog [ | inputlookup my_lookup.csv | fields host ]
| eventstats latest(_time) as TIME
| where _time = TIME
|dedup TIME
|table name DateTime Status host

Bye.
Giuseppe

[chadman]

I cant get the output to work. I believe this is because of the multiple search heads we have in our infrastructure. That's why I was trying to do this in one search without using an output.

[gcusello]

Search heads automatically align lookups,to use ldap search is possible but slow.
Bye.
Giuseppe